19 package org.sleuthkit.autopsy.thunderbirdparser;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.List;
25 import java.util.logging.Level;
26 import org.openide.util.NbBundle;
27 import org.openide.util.NbBundle.Messages;
45 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
79 if (abstractFile.getKnown().equals(TskData.FileKnown.KNOWN)) {
84 if ((abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) ||
85 (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK))) {
89 if ((abstractFile.isFile() ==
false)) {
94 boolean isMbox =
false;
96 byte[] t =
new byte[64];
97 if (abstractFile.getSize() > 64) {
98 int byteRead = abstractFile.read(t, 0, 64);
100 isMbox = MboxParser.isValidMimeTypeMbox(t);
103 }
catch (TskException ex) {
104 logger.log(Level.WARNING, null, ex);
111 if (PstParser.isPstFile(abstractFile)) {
125 @Messages({
"ThunderbirdMboxFileIngestModule.processPst.indexError.message=Failed to index encryption detected artifact for keyword search."})
127 String fileName =
getTempPath() + File.separator + abstractFile.getName()
128 +
"-" + String.valueOf(abstractFile.getId());
129 File file =
new File(fileName);
133 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
135 NbBundle.getMessage(this.getClass(),
136 "ThunderbirdMboxFileIngestModule.processPst.errMsg.outOfDiskSpace",
137 abstractFile.getName()));
144 }
catch (IOException ex) {
145 logger.log(Level.WARNING,
"Failed writing pst file to disk.", ex);
149 PstParser parser =
new PstParser(services);
150 PstParser.ParseResult result = parser.parse(file, abstractFile.getId());
152 if (result == PstParser.ParseResult.OK) {
155 }
else if (result == PstParser.ParseResult.ENCRYPT) {
158 BlackboardArtifact artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED);
159 artifact.addAttribute(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME,
EmailParserModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.encryptionFileLevel")));
166 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
170 }
catch (TskCoreException ex) {
171 logger.log(Level.INFO,
"Failed to add encryption attribute to file: {0}", abstractFile.getName());
176 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg",
177 abstractFile.getName()),
178 NbBundle.getMessage(
this.getClass(),
179 "ThunderbirdMboxFileIngestModule.processPst.errProcFile.details"));
180 logger.log(Level.INFO,
"PSTParser failed to parse {0}", abstractFile.getName());
184 if (file.delete() ==
false) {
185 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
188 String errors = parser.getErrors();
189 if (errors.isEmpty() ==
false) {
191 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg2",
192 abstractFile.getName()), errors);
206 String mboxFileName = abstractFile.getName();
207 String mboxParentDir = abstractFile.getParentPath();
209 String emailFolder =
"";
211 if (mboxParentDir.contains(
"/Mail/")) {
212 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/Mail/") + 5);
213 }
else if (mboxParentDir.contains(
"/ImapMail/")) {
214 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/ImapMail/") + 9);
216 emailFolder = emailFolder + mboxFileName;
217 emailFolder = emailFolder.replaceAll(
".sbd",
"");
219 String fileName =
getTempPath() + File.separator + abstractFile.getName()
220 +
"-" + String.valueOf(abstractFile.getId());
221 File file =
new File(fileName);
225 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
227 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg",
228 abstractFile.getName()),
229 NbBundle.getMessage(
this.getClass(),
230 "ThunderbirdMboxFileIngestModule.processMBox.errProfFile.details"));
236 }
catch (IOException ex) {
237 logger.log(Level.WARNING,
"Failed writing mbox file to disk.", ex);
241 MboxParser parser =
new MboxParser(services, emailFolder);
242 List<EmailMessage> emails = parser.parse(file, abstractFile.getId());
245 if (file.delete() ==
false) {
246 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
249 String errors = parser.getErrors();
250 if (errors.isEmpty() ==
false) {
252 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg2",
253 abstractFile.getName()), errors);
267 File dir =
new File(tmpDir);
268 if (dir.exists() ==
false) {
277 File dir =
new File(outDir);
278 if (dir.exists() ==
false) {
296 private void processEmails(List<EmailMessage> emails, AbstractFile abstractFile) {
297 List<AbstractFile> derivedFiles =
new ArrayList<>();
298 for (EmailMessage email : emails) {
299 if (email.hasAttachment()) {
305 if (derivedFiles.isEmpty() ==
false) {
306 for (AbstractFile derived : derivedFiles) {
323 private List<AbstractFile>
handleAttachments(List<EmailMessage.Attachment> attachments, AbstractFile abstractFile) {
324 List<AbstractFile> files =
new ArrayList<>();
325 for (EmailMessage.Attachment attach : attachments) {
326 String filename = attach.getName();
327 long crTime = attach.getCrTime();
328 long mTime = attach.getmTime();
329 long aTime = attach.getaTime();
330 long cTime = attach.getcTime();
331 String relPath = attach.getLocalPath();
332 long size = attach.getSize();
333 TskData.EncodingType encodingType = attach.getEncodingType();
337 size, cTime, crTime, aTime, mTime,
true, abstractFile,
"",
340 }
catch (TskCoreException ex) {
342 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.handleAttch.errMsg",
343 abstractFile.getName()),
344 NbBundle.getMessage(
this.getClass(),
345 "ThunderbirdMboxFileIngestModule.handleAttch.errMsg.details", filename));
346 logger.log(Level.INFO,
"", ex);
358 @Messages({
"ThunderbirdMboxFileIngestModule.addArtifact.indexError.message=Failed to index email message detected artifact for keyword search."})
359 private void addArtifact(EmailMessage email, AbstractFile abstractFile) {
360 List<BlackboardAttribute> bbattributes =
new ArrayList<>();
361 String to = email.getRecipients();
362 String cc = email.getCc();
363 String bcc = email.getBcc();
364 String from = email.getSender();
365 long dateL = email.getSentDate();
366 String body = email.getTextBody();
367 String bodyHTML = email.getHtmlBody();
368 String rtf = email.getRtfBody();
369 String subject = email.getSubject();
370 long id = email.getId();
371 String localPath = email.getLocalPath();
373 if (to.isEmpty() ==
false) {
374 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_TO,
EmailParserModuleFactory.getModuleName(), to));
376 if (cc.isEmpty() ==
false) {
377 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CC,
EmailParserModuleFactory.getModuleName(), cc));
379 if (bcc.isEmpty() ==
false) {
380 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_BCC,
EmailParserModuleFactory.getModuleName(), bcc));
382 if (from.isEmpty() ==
false) {
383 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
EmailParserModuleFactory.getModuleName(), from));
386 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD,
EmailParserModuleFactory.getModuleName(), dateL));
387 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT,
EmailParserModuleFactory.getModuleName(), dateL));
389 if (body.isEmpty() ==
false) {
390 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN,
EmailParserModuleFactory.getModuleName(), body));
392 if (bodyHTML.isEmpty() ==
false) {
393 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML,
EmailParserModuleFactory.getModuleName(), bodyHTML));
395 if (rtf.isEmpty() ==
false) {
396 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF,
EmailParserModuleFactory.getModuleName(), rtf));
398 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MSG_ID,
EmailParserModuleFactory.getModuleName(), ((
id < 0L) ? NbBundle
399 .getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(
id))));
400 if (subject.isEmpty() ==
false) {
401 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT,
EmailParserModuleFactory.getModuleName(), subject));
403 if (localPath.isEmpty() ==
false) {
404 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(), localPath));
406 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(),
"/foo/bar"));
410 BlackboardArtifact bbart;
411 bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
412 bbart.addAttributes(bbattributes);
418 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bbart.getArtifactID(), ex);
421 }
catch (TskCoreException ex) {
422 logger.log(Level.WARNING, null, ex);
426 void postErrorMessage(String subj, String details) {
431 IngestServices getServices() {
String getModuleOutputDirectoryRelativePath()
static final Logger logger
FileManager getFileManager()
String getTempDirectory()
static IngestMessage createErrorMessage(String source, String subject, String detailsHtml)
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
ProcessResult processMBox(AbstractFile abstractFile)
static final int DISK_FREE_SPACE_UNKNOWN
void processEmails(List< EmailMessage > emails, AbstractFile abstractFile)
void addFilesToJob(List< AbstractFile > files)
void addArtifact(EmailMessage email, AbstractFile abstractFile)
static String getModuleOutputPath()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
ProcessResult process(AbstractFile abstractFile)
String getModuleDirectory()
ProcessResult processPst(AbstractFile abstractFile)
void startUp(IngestJobContext context)
Blackboard getBlackboard()
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
static void error(String title, String message)
static String getRelModuleOutputPath()
synchronized void indexArtifact(BlackboardArtifact artifact)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static String getTempPath()
List< AbstractFile > handleAttachments(List< EmailMessage.Attachment > attachments, AbstractFile abstractFile)
static synchronized IngestServices getInstance()